Yes, sounds like it's throwing a false positive. When it comes to virus infections, I'd rather have a false positive than a false negative, and I think that the AV vendors tend to err on the cautious side as a result.
You did exactly what I'd have done, ie re-check with another vendor's solution.
By the way, just because your friend is computer-savvy doesn't mean that their address hadn't been spoofed, if they're found in the address book of someone who is infected, then their address can be used. If I'm suspicious about an attachment, I send a mail to the person asking htem if they recently sent me something
